{
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.05578971,
        "rte": "az",
        "prob": 0.05578971
      }
    ],
    "prob": 0.05578971,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.05578970909118652,
        "type": "rpm"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.05079936981201172,
        "type": "shell"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000417858362197876,
        "type": "shell"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000417858362197876,
        "type": "shell"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000417858362197876,
        "type": "shell"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000417858362197876,
        "type": "shell"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000417858362197876,
        "type": "shell"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000417858362197876,
        "type": "shell"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-02T06:03:15Z"
  },
  "path": "lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Er)H(Po₂)",
        "sha": "5e8ed23fa2bb8514ea1e7e87d4e1e24574cf34d91c8582216095e8bcb8415780",
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm",
        "risk": 3,
        "size": 181228,
        "type": "rpm",
        "facts": {
          "metrics": {
            "rpm": {
              "buildtime": 1782817511.0
            },
            "file": {
              "size": 181228.0,
              "entropy": 7.64,
              "size_bytes": 181228.0
            },
            "binary": {
              "overall_entropy": 7.64,
              "peak_region_bytes": 130028.0,
              "peak_region_entropy": 7.84
            }
          }
        },
        "ident": {
          "name": {
            "value": "lxdm",
            "source": "rpm.name",
            "verified": false
          },
          "urls": [
            {
              "url": "http://lxde.org",
              "kind": "homepage",
              "source": "rpm.url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Fedora Project",
              "role": "packager",
              "source": "rpm.packager"
            }
          ],
          "version": {
            "value": "0.5.3^20220831git2d4ba970",
            "source": "rpm.version",
            "verified": false
          },
          "organization": {
            "value": "Fedora Project",
            "source": "rpm.vendor",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/create/shell/spawn::bash-exec",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "bash shell reference"
          },
          {
            "id": "micro-behaviors/process/create/eval::shell-eval",
            "mbc": "E1059.004",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "eval command in shell script"
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-shell",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "Bash shell reference"
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-exec",
            "atk": "T1059",
            "crit": 3,
            "desc": "Shell exec builtin (process replacement)"
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-c-exec",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "shell execution with -c flag"
          },
          {
            "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "References hidden directory under home"
          },
          {
            "id": "micro-behaviors/process/interpreter/eval::shell-eval",
            "atk": "T1059",
            "crit": 3,
            "desc": "Shell eval call"
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "atk": "T1036.008",
            "mbc": "F0008",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "File starts with",
            "spans": [
              [
                0,
                13
              ]
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boXZ.B8\u0026{yx(kOkvrl8?3l{WoB7DF6vrl98w]zYjb4V1gv\u003c0vta$K\u003cIz*cqwaAzQxaz+$ex(k5mxK#0@ayYQsfjFTkflp!Hkmd:iw/$q2bQjA-wPn?Eat41AeP8WPbRZF=t@%fJxK#5*2#1D1mn)bRpFK4#f:.E",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "z!rZ1wGUn3cmf\u0026/atmqFv\u003eS7CA=kM7y?i@Tat4gFELir#Ab](ex(4u6t{7Evata^=fd}G*A=kM7y?i}Xx\u003ewF(at4gFfj/lnfix}-fl?hGx((1Mx(mTbA:{Xhz/6ufzxJjDaARpdzvdQhw[tH\u003eA:YpYe*8/UByM$af!\u003etax(mTbfl?hGx([x9eN@ZozeTq031Xu)v\u003c03}q+gmYm[3fLatmhrzzc6Aat47Cb4V1gv\u003c0vtayX=2xDO)pay39ooJUjZq=um-pfX$!3t13/w/$q2eQex\u003ewPRAnstqJ-CXI5fBt3:qwPI{bz/cX6j0nSUwO}\u00261azbg}z/Pm[31Xu)v\u003c03}q+gmYm[3fLatmhrzzc6Aat47Cb4V1gv\u003c0BoByM$af!\u003etax(mTbfiApbB8#5lzxJgd",
            "ln": 196,
            "col": 14,
            "line": 12
          },
          {
            "b": "Bzbl63jd2Jz/M$jazCZofj/lnfix}-fl?hGx((1Mx(mTbA:{.jfdF8aay]x$2)*]xat4*Xa%Z+Aayc9pclK]-a%Z+A3jd2Hz/fa[2)\u003e-(B7GCow^O\u0026Rx:LgNx\u003ewGixLy%\u0026ay[@7B1IipB-7Y5au?C?wP/.AB.\u003e\u003epcmf\u003cSwPI@oeQwJ-bT:$0q^SD(q=um-pg3s/q^R*Ul@DDLqZapg33o\u0026(zvcWRwP?G#ar\u00266VwmxX5eO[\u003crzEWu5eIh3SePVhPByxzpeIgKUx(\u003e}Jx([2uB7GAlx(v(ra{[S*x:LgNwQ4=@as6(:nmaUMmnu/8fjFTkflp!HeN][EwQ4=@at4yLvQTs\u003eat47CtP$B!sw}T!q+o+WtP$v0w[.OV",
            "ln": 984,
            "col": 39,
            "line": 34
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "which"
            ],
            [
              "",
              "which"
            ],
            [
              "",
              "test"
            ],
            [
              "",
              "test"
            ],
            [
              "",
              "eval"
            ],
            [
              "",
              "eval"
            ],
            [
              "",
              "dbus-launch"
            ],
            [
              "",
              "dbus-launch"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "exec"
            ],
            [
              "",
              "$LXSESSION"
            ],
            [
              "",
              "$f"
            ],
            [
              "",
              "/etc/X11/xinit/xinitrc-common"
            ],
            [
              "",
              "/etc/lxdm/xinitrc"
            ],
            [
              "",
              "/etc/xprofile"
            ],
            [
              "",
              "~/.xprofile"
            ]
          ],
          "tgt": [
            ".",
            "dbus-launch",
            "eval",
            "exec",
            "test",
            "which"
          ],
          "metrics": {
            "ast": {
              "op.eq": 1,
              "op.bnot": 1,
              "max_depth": 11,
              "call_count": 14,
              "node_count": 307,
              "op_density.eq": 0,
              "op_density.bnot": 0
            },
            "file": {
              "size": 1284,
              "entropy": 5.17
            },
            "text": {
              "lines": 48,
              "top_char": 101,
              "tab_count": 29,
              "max_ws_run": 1,
              "digit_ratio": 0.03,
              "space_count": 139,
              "char_entropy": 5.17,
              "unique_chars": 67,
              "top_char_null": 0,
              "string_density": 0.23,
              "top_char_ratio": 0.06,
              "avg_line_length": 25.75,
              "max_line_length": 73,
              "empty_line_ratio": 0.15,
              "last_line_length": 2,
              "whitespace_ratio": 0.17,
              "identifier_density": 1.63,
              "line_length_stddev": 23.12,
              "normalized_string_count": 1.59,
              "suspicious_string_ratio": 0.09,
              "suspicious_identifier_ratio": 0.21,
              "normalized_unique_identifiers": 5.19
            },
            "binds": {
              "count": 3
            },
            "binary": {
              "peak_region_bytes": 1284,
              "peak_region_entropy": 5.11
            },
            "imports": {
              "count": 6,
              "third_party_count": 6,
              "third_party_ratio": 1
            },
            "strings": {
              "bytes": 257,
              "count": 11,
              "shell": 1,
              "avg_length": 23.36,
              "max_length": 46,
              "path_count": 3,
              "avg_entropy": 3.04,
              "entropy_stddev": 1.31
            },
            "comments": {
              "chars": 208,
              "count": 9,
              "lines": 9,
              "to_code_ratio": 0.23
            },
            "identifiers": {
              "count": 78,
              "unique": 29,
              "avg_length": 11.93,
              "max_length": 29,
              "min_length": 1,
              "avg_entropy": 2.5,
              "reuse_ratio": 0.37,
              "length_stddev": 8.29,
              "has_digit_ratio": 0.24,
              "sequential_names": 1,
              "base64_like_names": 5,
              "single_char_count": 3,
              "single_char_ratio": 0.1,
              "high_entropy_count": 2,
              "high_entropy_ratio": 0.07,
              "all_lowercase_ratio": 0.17,
              "all_uppercase_ratio": 0.14
            }
          }
        },
        "id": 1,
        "mol": "H₂(CmPo₃)",
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm!!etc/lxdm/Xsession",
        "pid": 0,
        "risk": 3,
        "sha": "047b589f5549ced59275c56bfb620e3ba88ccc9f20ab168d3c4b664a011cd337",
        "size": 1284,
        "traits": [
          {
            "id": "micro-behaviors/communications/ipc/dbus::dbus-session-bus-address-env",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads the D-Bus session bus address",
            "spans": [
              [
                1125,
                24
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell evaluates variable command",
            "spans": [
              [
                1048,
                7
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::bash-exec",
            "conf": 0.7,
            "crit": 3,
            "desc": "References the Bash shell",
            "spans": [
              [
                384,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-exec",
            "atk": "T1059",
            "conf": 0.5,
            "crit": 3,
            "desc": "Uses shell exec to replace process",
            "spans": [
              [
                349,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-shell",
            "conf": 0.7,
            "crit": 3,
            "desc": "Bash shell reference",
            "spans": [
              [
                385,
                7
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/eval::shell-eval",
            "atk": "T1059",
            "conf": 0.5,
            "crit": 3,
            "desc": "Evaluates a shell command string",
            "spans": [
              [
                1160,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell command execution capability",
            "uses": [
              3,
              4
            ],
            "spans": [
              [
                349,
                4
              ],
              [
                385,
                7
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::child-process-execution",
            "atk": "T1059",
            "conf": 0.94,
            "crit": 3,
            "desc": "Executes a child process",
            "uses": [
              6
            ],
            "spans": [
              [
                349,
                4
              ],
              [
                385,
                7
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 1,
              "call_count": 0,
              "node_count": 4
            },
            "file": {
              "size": 68,
              "entropy": 4.19
            },
            "text": {
              "lines": 3,
              "top_char": 115,
              "max_ws_run": 1,
              "space_count": 12,
              "char_entropy": 4.19,
              "unique_chars": 24,
              "top_char_null": 0,
              "top_char_ratio": 0.1,
              "avg_line_length": 21.67,
              "max_line_length": 51,
              "last_line_length": 51,
              "whitespace_ratio": 0.22,
              "line_length_stddev": 21.31
            },
            "binary": {
              "peak_region_bytes": 68,
              "peak_region_entropy": 4.19
            },
            "comments": {
              "chars": 62,
              "count": 3,
              "empty": 1,
              "lines": 2,
              "to_code_ratio": 2
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm!!etc/lxdm/PreShutdown",
        "pid": 0,
        "sha": "a1d02d4d15d9caddb3c9f77a6b1e4235ab70cde3ad9f87bc571838368e0e1be0",
        "size": 68,
        "traits": [
          {
            "id": "metadata/file/metrics::source-degenerate-ast",
            "conf": 0.85,
            "crit": 1,
            "desc": "Source parses to a degenerate AST",
            "spans": [
              [
                0,
                0
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 1,
              "call_count": 0,
              "node_count": 4
            },
            "file": {
              "size": 68,
              "entropy": 4.19
            },
            "text": {
              "lines": 3,
              "top_char": 115,
              "max_ws_run": 1,
              "space_count": 12,
              "char_entropy": 4.19,
              "unique_chars": 24,
              "top_char_null": 0,
              "top_char_ratio": 0.1,
              "avg_line_length": 21.67,
              "max_line_length": 51,
              "last_line_length": 51,
              "whitespace_ratio": 0.22,
              "line_length_stddev": 21.31
            },
            "binary": {
              "peak_region_bytes": 68,
              "peak_region_entropy": 4.19
            },
            "comments": {
              "chars": 62,
              "count": 3,
              "empty": 1,
              "lines": 2,
              "to_code_ratio": 2
            }
          }
        },
        "id": 3,
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm!!etc/lxdm/PreReboot",
        "pid": 0,
        "sha": "a1d02d4d15d9caddb3c9f77a6b1e4235ab70cde3ad9f87bc571838368e0e1be0",
        "size": 68,
        "traits": [
          {
            "id": "metadata/file/metrics::source-degenerate-ast",
            "conf": 0.85,
            "crit": 1,
            "desc": "Source parses to a degenerate AST",
            "spans": [
              [
                0,
                0
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 1,
              "call_count": 0,
              "node_count": 4
            },
            "file": {
              "size": 68,
              "entropy": 4.19
            },
            "text": {
              "lines": 3,
              "top_char": 115,
              "max_ws_run": 1,
              "space_count": 12,
              "char_entropy": 4.19,
              "unique_chars": 24,
              "top_char_null": 0,
              "top_char_ratio": 0.1,
              "avg_line_length": 21.67,
              "max_line_length": 51,
              "last_line_length": 51,
              "whitespace_ratio": 0.22,
              "line_length_stddev": 21.31
            },
            "binary": {
              "peak_region_bytes": 68,
              "peak_region_entropy": 4.19
            },
            "comments": {
              "chars": 62,
              "count": 3,
              "empty": 1,
              "lines": 2,
              "to_code_ratio": 2
            }
          }
        },
        "id": 4,
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm!!etc/lxdm/PreLogin",
        "pid": 0,
        "sha": "a1d02d4d15d9caddb3c9f77a6b1e4235ab70cde3ad9f87bc571838368e0e1be0",
        "size": 68,
        "traits": [
          {
            "id": "metadata/file/metrics::source-degenerate-ast",
            "conf": 0.85,
            "crit": 1,
            "desc": "Source parses to a degenerate AST",
            "spans": [
              [
                0,
                0
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 1,
              "call_count": 0,
              "node_count": 4
            },
            "file": {
              "size": 68,
              "entropy": 4.19
            },
            "text": {
              "lines": 3,
              "top_char": 115,
              "max_ws_run": 1,
              "space_count": 12,
              "char_entropy": 4.19,
              "unique_chars": 24,
              "top_char_null": 0,
              "top_char_ratio": 0.1,
              "avg_line_length": 21.67,
              "max_line_length": 51,
              "last_line_length": 51,
              "whitespace_ratio": 0.22,
              "line_length_stddev": 21.31
            },
            "binary": {
              "peak_region_bytes": 68,
              "peak_region_entropy": 4.19
            },
            "comments": {
              "chars": 62,
              "count": 3,
              "empty": 1,
              "lines": 2,
              "to_code_ratio": 2
            }
          }
        },
        "id": 5,
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm!!etc/lxdm/PostLogout",
        "pid": 0,
        "sha": "a1d02d4d15d9caddb3c9f77a6b1e4235ab70cde3ad9f87bc571838368e0e1be0",
        "size": 68,
        "traits": [
          {
            "id": "metadata/file/metrics::source-degenerate-ast",
            "conf": 0.85,
            "crit": 1,
            "desc": "Source parses to a degenerate AST",
            "spans": [
              [
                0,
                0
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 1,
              "call_count": 0,
              "node_count": 4
            },
            "file": {
              "size": 68,
              "entropy": 4.19
            },
            "text": {
              "lines": 3,
              "top_char": 115,
              "max_ws_run": 1,
              "space_count": 12,
              "char_entropy": 4.19,
              "unique_chars": 24,
              "top_char_null": 0,
              "top_char_ratio": 0.1,
              "avg_line_length": 21.67,
              "max_line_length": 51,
              "last_line_length": 51,
              "whitespace_ratio": 0.22,
              "line_length_stddev": 21.31
            },
            "binary": {
              "peak_region_bytes": 68,
              "peak_region_entropy": 4.19
            },
            "comments": {
              "chars": 62,
              "count": 3,
              "empty": 1,
              "lines": 2,
              "to_code_ratio": 2
            }
          }
        },
        "id": 6,
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm!!etc/lxdm/PostLogin",
        "pid": 0,
        "sha": "a1d02d4d15d9caddb3c9f77a6b1e4235ab70cde3ad9f87bc571838368e0e1be0",
        "size": 68,
        "traits": [
          {
            "id": "metadata/file/metrics::source-degenerate-ast",
            "conf": 0.85,
            "crit": 1,
            "desc": "Source parses to a degenerate AST",
            "spans": [
              [
                0,
                0
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 1,
              "call_count": 0,
              "node_count": 4
            },
            "file": {
              "size": 68,
              "entropy": 4.19
            },
            "text": {
              "lines": 3,
              "top_char": 115,
              "max_ws_run": 1,
              "space_count": 12,
              "char_entropy": 4.19,
              "unique_chars": 24,
              "top_char_null": 0,
              "top_char_ratio": 0.1,
              "avg_line_length": 21.67,
              "max_line_length": 51,
              "last_line_length": 51,
              "whitespace_ratio": 0.22,
              "line_length_stddev": 21.31
            },
            "binary": {
              "peak_region_bytes": 68,
              "peak_region_entropy": 4.19
            },
            "comments": {
              "chars": 62,
              "count": 3,
              "empty": 1,
              "lines": 2,
              "to_code_ratio": 2
            }
          }
        },
        "id": 7,
        "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/lxdm/lxdm-0.5.3^20220831git2d4ba970-15.fc45.aarch64.rpm!!etc/lxdm/LoginReady",
        "pid": 0,
        "sha": "a1d02d4d15d9caddb3c9f77a6b1e4235ab70cde3ad9f87bc571838368e0e1be0",
        "size": 68,
        "traits": [
          {
            "id": "metadata/file/metrics::source-degenerate-ast",
            "conf": 0.85,
            "crit": 1,
            "desc": "Source parses to a degenerate AST",
            "spans": [
              [
                0,
                0
              ]
            ]
          }
        ],
        "type": "shell"
      }
    ],
    "rev": "46112",
    "v": "8"
  }
}